Privacy Policy · Kavach

The short version

We collect what we need to run your account: your email, a hashed password, the answers you give us, and basic sign-in records.
We use one cookie, to keep you signed in. No advertising or analytics cookies, and no tracking scripts.
We don’t sell your data, and we don’t use your code to train AI models.
You can ask us to see, correct or delete your data at any time.

1. Who we are

Kavach is operated by Ritvexa Innovations Private Limited, a company registered in India at [registered address] (“Ritvexa”, “we”, “us”). We decide how and why your personal data is used, which makes us the data fiduciary (or data controller) for the processing described here.

Questions about privacy: hello@ritvexa.com.

2. What we collect

Data	Why	Where it comes from
Email address	To create and secure your account and to email you about it	You, at sign-up
Password	To let you sign in. We store only a one-way hash (bcrypt), never the password itself	You
First-run answers (what you built with, your role, your app’s stage, the features you want, an optional note)	To decide who gets early access first and what to build next	You, optionally
Which page or button you signed up from	To understand which parts of our site help people	Your browser, at sign-up
Sign-in records: IP address, browser user agent, sign-in and last-seen times	To keep your account secure and stop abuse	Your browser
Email delivery records	To know whether account emails were sent	Our email service

Your code. Code scanning is not available yet. Before it opens, we will update this policy to explain exactly what we access when you connect GitHub, how long we keep it, and which service providers process it. Our commitments: access will be read-only and limited to repositories you choose, and your code will not be used to train AI models.

We don’t knowingly collect data from children. Kavach is not intended for anyone under 18.

3. How we use it, and on what basis

To provide Kavach (create your account, sign you in, send verification and password emails): necessary to provide the service you asked for.
To keep Kavach secure (rate limits, detecting abuse, investigating incidents): our legitimate interest, and our legal obligations.
To decide early access and improve the product (your first-run answers and sign-up source): your consent, which you give by answering. The questions are optional and you can change or clear your answers.
To tell our team about new sign-ups: our legitimate interest in running the early-access programme.

We will not send you marketing email without asking first.

4. Cookies and similar technologies

We use a single, strictly necessary cookie, __Host-kavach_session, set by the Kavach app (app.kavachcode.tech) to keep you signed in. This marketing site sets no cookies at all. It is HttpOnly (scripts can’t read it), it expires after 30 days, and signing out removes it. During sign-up, your browser also keeps your email address insession storage so the next page can show it; this is cleared when you close the tab.

We don’t use analytics, advertising or social media cookies, and our pages don’t load anything from third parties (our fonts are served from our own servers).

5. Who we share it with

We don’t sell or rent personal data. We share it only with service providers who help us run Kavach, under contracts that limit them to our instructions:

Hosting: [hosting provider and region], where our servers and database run.
Email delivery: [email provider, e.g. Google Workspace], which sends account emails on our behalf.

We may also disclose data if the law requires it, to protect people’s safety, or as part of a merger or acquisition (in which case this policy will continue to apply to your data).

6. Where your data is stored

Your data is stored in [country / region]. If it is transferred to another country, we make sure it is protected as required by applicable law, including the Digital Personal Data Protection Act, 2023 (India) and, where it applies, the GDPR.

7. How long we keep it

Account data and answers: while your account exists. When you delete your account we delete them within 30 days, except where the law requires us to keep something longer.
Sign-in records: until the session ends or expires (at most 30 days).
Unverified sign-ups: [period, e.g. 30 days] after sign-up if the email is never verified.
Backups: up to [period] before they are overwritten.

8. How we protect it

Passwords are hashed with bcrypt. Connections are encrypted with HTTPS. Sessions can be revoked at any time, and resetting your password signs out every browser. Our database is not reachable from the internet, and access to production systems is limited to people who need it. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authorities as the law requires.

9. Your rights

You can ask us to:

tell you what personal data we hold about you and give you a copy;
correct or update it;
delete it, along with your account;
stop using it for a purpose that relies on your consent, such as your first-run answers;
nominate someone to exercise these rights for you if you die or become incapacitated (India).

Email hello@ritvexa.com from the address on your account. We will reply within 30 days. If you are in the EU or UK you can also complain to your local data protection authority.

10. Grievance officer

[Name], Grievance Officer, Ritvexa Innovations Private Limited, [address]. Email: [grievance email]. We will acknowledge a grievance within [48 hours] and resolve it within [30 days]. If you aren’t satisfied, you may complain to the Data Protection Board of India.

11. Changes to this policy

If we make a material change, we will email you or show a notice in the app before it takes effect. The date at the top shows when this policy last changed.